To be as restful as possible, is a user login better designed using a GET or a POST on a REST webservice? And why?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
I would use a POST, since it makes serious changes to the state of the server (even if not saved into the database). Though that's more a HTTP rule than REST.
This article at InfoQ has helped with my understanding of REST. Paraphrasing from the Use standard methods section:
According to IBM DeveloperWorks though:
Based on these definitions, if you plan to continually update some kind of access token to indicate that a user is still logged in, use POST to create it, then PUT to update it on subsequent requests.
Also, from the Communicate statelessly section:
Given that, it seems like we shouldn't be creating any server state to track what users are logged in; rather we should perhaps be using HTTP Authentication.
Here's another good question related to the issue of authentication for REST services.